{"id":"CMP-202611-gcacwi","kind":"campaign","aliases":[],"related":[],"title":"Fake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)","description":null,"summary":"Microsoft reports two intrusions in which attackers messaged and called employees on Microsoft Teams from outside tenants with support-themed names, posing as the company's IT help desk, and talked them into giving remote control through Windows Quick Assist. They then ran scripts with portable Python, Bun or Java runtimes and abused insecure Active Directory Certificate Services: an ESC1 certificate template (requester picks the account) gave certificates for 11 privileged accounts, followed by DCSync on a domain controller. In the other case, PetitPotam coercion plus an NTLM relay to AD CS web enrollment (ESC8) gave a certificate for the domain controller and a Kerberos TGT. In one case data was copied with a renamed Rclone to an outside SFTP server, through a privileged account that had been left out of Defender's automatic attack disruption. These certificates keep working after a password reset or reimaging. No Teams flaw was used. Not tied to any known group. Intrusion dates unknown; reported 2026-11-02.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-02T11:41:47+00:00","products":[{"name":"Microsoft Teams","fixed":[],"vendor":"Microsoft"},{"name":"Active Directory Certificate Services","fixed":[],"vendor":"Microsoft"},{"name":"Quick Assist","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for Teams chats or calls from external tenants with help-desk or support names followed by Quick Assist sessions. Look for archives unpacked from Downloads into folders named like Windows updates and run with portable python/bun/java. File hashes (SHA-256): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JS), f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python). In AD CS logs, check for certificates issued for privileged accounts or domain controllers with a requester-supplied subject (ESC1). Also check for NTLM authentication to /certsrv web enrollment (ESC8), DCSync from non-DC hosts, and renamed rclone sending data to external SFTP. Run Defender for Identity ESC1/ESC8 posture checks.","fix":"Restrict which external Teams tenants can reach staff, and have users confirm support requests through a known internal channel. Block Quick Assist where it is not an approved support tool. Remove enrollee-supplied subject and broad enrollment rights from authentication certificate templates. On AD CS web enrollment, require HTTPS, enable EPA and disable NTLM (KB5005413). EPA is on by default only in Windows Server 2025, so 2019 and 2022 need it set manually. Turn on certificate auditing. If a bad certificate was issued, revoke it and also review or purge Kerberos tickets already issued, because revocation does not cancel them. Make sure no privileged account is left out of automatic containment without a manual response plan.","status":"open","published_at":null,"first_seen_at":"2026-11-02T11:41:47+00:00","triaged_at":"2026-11-02T11:41:47+00:00","updated_at":"2026-11-02T11:41:47+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-02':208B '-11':207B '-202611':30A '11':114B '2026':206B 'abus':14A,97B 'account':110B,116B,169B 'activ':99B 'active':34A 'ad':16A,135B 'admin':23A 'assist':12A,39A,84B 'attack':50B,179B 'automat':178B 'bun':92B 'call':53B 'campaign':40B 'case':127B,153B 'certif':24A,101B,105B,112B,142B,182B 'certificate':36A 'cmp':29A 'coercion':129B 'compani':69B 'control':9A,80B,123B,146B 'copi':156B 'cs':17A,136B 'data':27A,154B 'date':203B 'dcsync':119B 'defend':176B 'desk':73B 'directori':100B 'directory':35A 'disrupt':180B 'domain':22A,122B,145B 'domain-admin':21A 'earli':42B 'early-warn':41B 'employe':54B 'enrol':138B 'esc1':18A,104B 'esc8':19A,139B 'fake':1A 'flaw':193B 'follow':117B 'gave':111B,140B 'gcacwi':31A 'get':7A 'give':78B 'group':201B 'help':72B 'insecur':98B 'intrus':47B,202B 'java':94B 'keep':183B 'kerbero':149B 'known':200B 'left':173B 'messag':51B 'microsoft':5A,28A,32A,44B,56B 'misconfigur':15A 'name':65B 'ntlm':132B 'one':152B 'outsid':59B,163B 'password':187B 'petitpotam':128B 'pick':108B 'plus':130B 'portabl':90B 'pose':66B 'privileg':115B,168B 'python':91B 'quick':11A,38A,83B 'ran':87B 'rclone':160B 'reimag':190B 'relay':133B 'remot':8A,79B 'renam':159B 'report':45B,205B 'request':107B 'reset':188B 'runtim':95B 'script':88B 'server':165B 'servic':102B 'services':37A 'sftp':164B 'steal':26A 'support':3A,63B 'support-them':62B 'talk':75B 'team':6A,57B,192B 'teams':33A 'templat':106B 'tenant':60B 'tgt':150B 'theme':64B 'tie':197B 'two':46B 'unknown':204B 'use':195B 'via':10A 'warn':43B 'web':137B 'window':82B 'work':184B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["activedirectorycertificateservices","assist","directorycertificateservices","microsoftteams","quickassist","teams"],"ptokens":["active","assist","certificate","directory","microsoft","quick","services","teams"],"labels":["campaign","earlywarning","high","infrastructure"],"first_public_at":"2026-11-02T11:08:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-gcacwi","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T11:41:47+00:00","fetched_at":"2026-11-02T11:41:47+00:00","note":null}],"documents":[{"id":51546,"url":"https://x.com/TheHackersNews/status/2117212735029313547","title":"@TheHackersNews: ⚠️ Attackers impersonated IT support on Microsoft Teams, tricked employees into ","kind":"post","source":"x","publisher":null,"text":"⚠️ Attackers impersonated IT support on Microsoft Teams, tricked employees into granting remote access, and abused AD CS to gain privileged access.\n\nIn one case, they stole company data even after Microsoft Defender blocked most of the attack.\n\nRead: https://t.co/SitQ3GMdVm\n\nlikes 48 reposts 17","published_at":"2026-11-02T11:10:26+00:00","relation":"describes","confidence":null,"note":null},{"id":51656,"url":"https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html","title":"Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data (The Hacker News, reporting Microsoft)","kind":"blog","source":"analyst","publisher":null,"text":"Microsoft investigated two intrusions: attackers posing as IT/help desk from external Teams tenants with support-themed names got users to start Quick Assist; dropped archive in Downloads, unpacked to a Windows-update-like folder, ran with portable Python, Bun or Java. Case 1: ESC1 template abuse gave certificates for 11 privileged accounts, DCSync on a domain controller, one account excluded from Defender automatic attack disruption used to exfiltrate file share data with renamed Rclone to external SFTP. Case 2: PetitPotam coercion + NTLM relay to AD CS web enrollment (ESC8), certificate for the DC, PKINIT TGT; stopped by isolation. Not attributed, no dates given. Certificates survive password resets and reimaging; revocation does not cancel issued Kerberos tickets. SHA-256: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JS), f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python), 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python). Fix: verify support requests, restrict external Teams tenants, allow only approved remote tools, fix ESC1 templates, HTTPS+EPA and disable NTLM on AD CS web enrollment (KB5005413); Server 2025 has EPA by default.","published_at":"2026-11-02T11:08:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}